North Carolina cybersecurity law
NCITPA: what every Charlotte business needs to know.
North Carolina's Identity Theft Protection Act (N.C. Gen. Stat. § 75-60 through § 75-65), amended again in 2025 under Session Law 2025-25, requires any business that owns or licenses personal information of NC residents to provide breach notification "without unreasonable delay" to affected individuals and the NC Attorney General's Consumer Protection Division. Breaches affecting more than 1,000 people also trigger notification to all national consumer reporting agencies.
Unlike Texas, North Carolina has no statutory safe harbor tied to a documented cybersecurity program, and unlike most states, NC's law does not even exempt businesses based on encryption alone. A violation is treated as a violation of the NC Unfair and Deceptive Trade Practices Act (G.S. 75-1.1), opening businesses to private causes of action, treble damages, and AG enforcement.
The practical takeaway: in North Carolina, a documented, framework-aligned cybersecurity program isn't a legal defense the way Texas SB 2610 is, it's your strongest evidence of due care if the AG or a plaintiff's attorney comes calling. The lack of safe harbor makes the program more important here, not less.
We are not your attorney; this isn't legal advice. CHR works alongside your counsel and insurer to build the documented program your business needs.
Framework alignment by business size
Under 20 employees
Documented password policy, MFA on email and admin accounts, security-awareness training, basic incident response plan.
20 to 99 employees
CIS Controls Implementation Group 1, 56 safeguards covering inventory, access control, data protection, logging, training.
100 to 249 employees
NIST CSF 2.0, ISO 27001, CIS Controls IG2/IG3, SOC 2, or PCI-DSS, whichever maps best to your regulators, customers, and insurance.
Regulated / 250+
HIPAA Security Rule, GLBA Safeguards Rule, CMMC 2.0 for defense supply chains, SOX IT general controls, plus continuous monitoring and annual third-party assessment.